[android-common:android15-6.6 19/19] drivers/mmc/host/mmc_spi.c:172 mmc_spi_skip() error: buffer overflow 'cp' 29 <= 31

BCC: [email protected]
CC: [email protected]
TO: [email protected]

tree:   https://android.googlesource.com/kernel/common android15-6.6
head:   713cfd970c85b62fef547f66366270b9124c5c92
commit: 095cb607f1468d75d87a80ad16e513c8fe82d8e7 [19/19] mmc: mmc_spi: remove custom DMA mapped buffers
:::::: branch date: 15 hours ago
:::::: commit date: 2 years, 5 months ago
config: x86_64-randconfig-161 (https://download.01.org/0day-ci/archive/20260710/[email protected]/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9185-gbcc58b9c

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Reported-by: Dan Carpenter <[email protected]>
| Closes: https://lore.kernel.org/r/[email protected]/

New smatch warnings:
drivers/mmc/host/mmc_spi.c:172 mmc_spi_skip() error: buffer overflow 'cp' 29 <= 31

Old smatch warnings:
drivers/mmc/host/mmc_spi.c:173 mmc_spi_skip() error: buffer overflow 'cp' 29 <= 31

vim +/cp +172 drivers/mmc/host/mmc_spi.c

15a0580ced081a David Brownell  2007-08-08  156  
56e303ebeec7ef Wolfgang Muees  2009-04-07  157  static int mmc_spi_skip(struct mmc_spi_host *host, unsigned long timeout,
56e303ebeec7ef Wolfgang Muees  2009-04-07  158  			unsigned n, u8 byte)
15a0580ced081a David Brownell  2007-08-08  159  {
15a0580ced081a David Brownell  2007-08-08  160  	u8 *cp = host->data->status;
56e303ebeec7ef Wolfgang Muees  2009-04-07  161  	unsigned long start = jiffies;
15a0580ced081a David Brownell  2007-08-08  162  
696068470e38e4 Andy Shevchenko 2021-06-23  163  	do {
15a0580ced081a David Brownell  2007-08-08  164  		int		status;
15a0580ced081a David Brownell  2007-08-08  165  		unsigned	i;
15a0580ced081a David Brownell  2007-08-08  166  
15a0580ced081a David Brownell  2007-08-08  167  		status = mmc_spi_readbytes(host, n);
15a0580ced081a David Brownell  2007-08-08  168  		if (status < 0)
15a0580ced081a David Brownell  2007-08-08  169  			return status;
15a0580ced081a David Brownell  2007-08-08  170  
15a0580ced081a David Brownell  2007-08-08  171  		for (i = 0; i < n; i++) {
15a0580ced081a David Brownell  2007-08-08 @172  			if (cp[i] != byte)
15a0580ced081a David Brownell  2007-08-08  173  				return cp[i];
15a0580ced081a David Brownell  2007-08-08  174  		}
15a0580ced081a David Brownell  2007-08-08  175  
696068470e38e4 Andy Shevchenko 2021-06-23  176  		/* If we need long timeouts, we may release the CPU */
696068470e38e4 Andy Shevchenko 2021-06-23  177  		cond_resched();
696068470e38e4 Andy Shevchenko 2021-06-23  178  	} while (time_is_after_jiffies(start + timeout));
15a0580ced081a David Brownell  2007-08-08  179  	return -ETIMEDOUT;
15a0580ced081a David Brownell  2007-08-08  180  }
15a0580ced081a David Brownell  2007-08-08  181  

:::::: The code at line 172 was first introduced by commit
:::::: 15a0580ced081a0f7dc2deea8a4812bdc5e9a109 mmc_spi host driver

:::::: TO: David Brownell <[email protected]>
:::::: CC: Pierre Ossman <[email protected]>

--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki